Is CVE-2026-16095 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-16095?

CVE-2026-16095 has a CVSS v3 severity of HIGH (8.8).

Back

CVE-2026-16095

Description

A flaw has been found in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124. Affected by this issue is the function setup_conntrack of the file /sbin/rc. Executing a manipulation of the argument ct_tcp_timeout can lead to out-of-bounds write. The attack may be performed from remote. This project is superseded by FreshTomato.